Privacy Policy

FinHome (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal and financial information when you use the FinHome household financial management application (“Service”).

By using FinHome, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide Directly

• Name and email address (account registration)
• Password (stored as a one-way bcrypt hash — never in plaintext)
• Household name and membership
• Manually entered financial data: income, expenses, budgets, debts, savings goals, and assets

1.2 Financial Data via Plaid

When you connect a bank or financial institution, FinHome uses Plaid Technologies, Inc. as a financial data intermediary. Through Plaid, we may receive:

• Account names, types, and balances
• Transaction history (descriptions, amounts, dates, categories)
• Liability information (credit cards, loans, mortgages)
• Investment holdings and values
• Account and routing numbers (Auth product — only if you connect via Auth)
• Identity information (name, address, phone — only if you connect via Identity)

Plaid’s own privacy practices are described in the Plaid End User Privacy Policy.

1.3 Authentication & Security Data

• One-time passwords (OTP) used for multi-factor authentication — stored as SHA-256 hashes, automatically deleted after use or expiry
• Session tokens (JWT, stored in encrypted cookies)

1.4 Automatically Collected Information

• Server logs (IP address, request timestamps, HTTP status codes) — used for security monitoring and retained for up to 30 days

2. How We Use Your Information

• To provide and operate the FinHome Service
• To display your financial data within your household dashboard
• To synchronize transaction and balance data from connected financial institutions via Plaid
• To send one-time verification codes for multi-factor authentication
• To maintain the security and integrity of your account
• To respond to your support requests
• To comply with applicable laws and legal obligations

We do not sell your personal or financial data to third parties. We do not use your data for advertising or marketing to third parties.

3. How We Share Your Information

We share your information only in the following limited circumstances:

4. Data Security

• Passwords are hashed with bcrypt (cost factor 12) — never stored in plaintext
• Plaid access tokens are encrypted at rest using AES-256-CBC
• All data is transmitted over TLS/HTTPS
• Multi-factor authentication (email OTP) is required for all logins
• Database access is restricted to localhost on the server — no public network exposure

Despite these measures, no system is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorized access to your account.

5. Data Retention

• Your account data is retained for as long as your account remains active
• MFA tokens expire after 10 minutes and are deleted immediately after use
• When you close your account, all household data (including Plaid connections and transaction history) is permanently deleted within 30 days
• You may request earlier deletion by contacting us at the address below

6. Your Rights & Choices

Disconnect Financial Accounts

You can disconnect any linked bank account at any time from the Accounts page. This removes the Plaid connection and stops data sync. You can also disconnect all banks at once via Settings → Data & Privacy.

Delete Your Account

You can permanently close your account from Settings → Data & Privacy → Close account. This deletes all your personal data, financial data, and Plaid connections. If you are the last member of a household, the entire household and all associated data is deleted.

Access & Correction

You may view and update your profile information within the app at any time. For requests to access, correct, or export your data, contact us at the address below.

7. Children’s Privacy

FinHome is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date. Continued use of the Service after changes constitutes your acceptance of the updated policy.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: